returns a session anyway to avoid leaking user names